A point-to-point secure networking method and device

Abstract

The application provides a point-to-point secure networking method and device, and relates to the technical field of data transmission. The method determines an effective target data contract according to a demander node identifier, a target database resource identifier and an access credential, and determines a target address and a target port of the target database resource in a supplier network according to the target data contract. A proxy channel pointing to the target database resource is created by a supplier connector on an available proxy port, which can reduce the risk of exposing the real network location of the database to the outside and the demander bypassing the proxy channel to directly access the database. Meanwhile, an association between the proxy channel and the demander node identifier, the target data contract, the target database resource and the access credential is established, and the access credential is verified when a resource access connection is accepted, so that the forwarding range of the proxy channel corresponds to the authorized resources defined by the data contract, and the controllability of cross-institution database access is improved.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and more specifically, to a point-to-point secure networking method and apparatus. Background Technology

[0002] With the increasing demand for cross-organizational data flow, different organizations need to access data resources such as databases across their respective internal networks. Since the network environments of different organizations are isolated from each other, it is usually necessary to use methods such as public network port mapping, virtual private networks, network tunnels, or proxy forwarding to establish cross-network access paths in order to enable data transmission between data requesters and data providers.

[0003] Existing cross-network access methods primarily focus on resolving network connectivity issues. The established access paths typically have relatively fixed network access ranges, making it difficult to restrict accessible resources based on specific data access authorizations. Furthermore, some access methods require providing the network address or port information of data resources, increasing the risk of data resources being probed or accessed directly by bypassing the established access path. Therefore, how to reduce the exposure of data resource network information while ensuring that cross-network access paths are compatible with the data access authorization range becomes a problem that needs to be solved. Summary of the Invention

[0004] This application provides at least one point-to-point secure networking method and apparatus.

[0005] In a first aspect, embodiments of this application provide a point-to-point secure networking method, applied to a supplier connector, comprising:

[0006] Receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes the target database resource identifier and access credentials. If the access credentials are found to be valid, the target data contract is determined from the valid data contracts based on the demand node identifier and the target database resource identifier, and the target address and target port of the target database resource in the supplier network are determined based on the target database resource defined by the target data contract. Determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials; Send the channel access information of the proxy channel to the demand connector, the channel access information including the available proxy port but excluding the target address and the target port; The system accepts resource access connections initiated by the demand connector on the available proxy port, verifies the access credentials corresponding to the resource access connection according to the association, and forwards data between the resource access connection and the target database resource through the proxy channel after successful verification.

[0007] In one optional implementation, the channel access information further includes the declared address of the supplier connector; Before sending the channel access information, the method further includes: The declared address is determined sequentially according to the priority of the configured external address, the network address of the specified network interface card, the network address of the network virtual interface card, and the public address obtained through the external network address detection service; If the specified network interface card is configured but a valid network address for the specified network interface card cannot be obtained, stop determining the declared address and output an address resolution failure message.

[0008] In one optional implementation, determining the demand node identifier corresponding to the demand connector includes: Obtain the node certificate of the demand connector and verify the validity period, issuer, and certificate fingerprint of the node certificate; After successful verification, the certificate serial number or public key identifier of the node certificate is determined as the identifier of the demand node.

[0009] In one optional implementation, before creating the proxy channel, the method further includes: Send a connection probe request to the target address and the target port, and when the connection probe is successful, sequentially check the occupancy status of each candidate proxy port starting from the starting port of the proxy port range; The first unoccupied candidate proxy port is identified as the available proxy port, and if there are no unoccupied candidate proxy ports within the scope of the proxy ports, the creation of the proxy channel is rejected.

[0010] In one optional implementation, creating the proxy channel on the available proxy port includes: Start the Transmission Control Protocol (TCP) listening service on the available proxy port; After successful verification, the process of forwarding data between the resource access connection and the target database resource via the proxy channel includes: Establish a target database connection based on the target address and the target port; Bidirectional byte stream forwarding is performed between the resource access connection and the target database connection, and the number of active connections in the proxy channel is updated. When the number of active connections reaches the maximum number of connections for the proxy channel, accepting new resource access connections will stop.

[0011] In one optional implementation, the channel establishment request further includes an access session identifier, and the access credential has a credential status and a validity period; When creating the proxy channel, a channel number is assigned to the proxy channel, and a mapping relationship is established between the access session identifier, the access credential, the channel number, and the proxy channel; The step of verifying the access credentials corresponding to the resource access connection based on the association includes: Based on the mapping relationship, verify the credential status and validity period of the access credential, and verify whether the demand node identifier, target data contract and target database resource associated with the access credential match the resource access connection.

[0012] In one optional implementation, the method further includes: Monitor the validity status of the target data contract, the access session corresponding to the access session identifier, and the access credential; Stop accepting new resource access connections through the proxy channel when the target data contract expires, the access session times out, or the access credential expires. When active data transmission in the proxy channel is completed or the maximum waiting time is reached, the proxy channel is closed, the mapping relationship is deleted, and the available proxy port is restored to an idle state.

[0013] Secondly, embodiments of this application also provide a point-to-point secure networking device for a supplier connector, comprising: The receiving module is used to receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes a target database resource identifier and access credentials. The determination module is used to determine the target data contract from the valid data contracts based on the demand node identifier and the target database resource identifier when the access credential is determined to be valid, and to determine the target address and target port of the target database resource in the supplier network based on the target database resource defined by the target data contract. The construction module is used to determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials; The sending module is used to send the channel access information of the proxy channel to the demand connector, wherein the channel access information includes the available proxy port but does not include the target address and the target port; The transmission module is configured to accept resource access connections initiated by the demand connector on the available proxy port, verify the access credentials corresponding to the resource access connection according to the association relationship, and forward data between the resource access connection and the target database resource through the proxy channel after successful verification.

[0014] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps of the first aspect above, or any possible implementation of the first aspect, are performed.

[0015] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps described in the first aspect or any possible implementation of the first aspect.

[0016] The point-to-point secure networking method and apparatus provided in this application determine a valid target data contract based on the demand node identifier, the target database resource identifier, and access credentials. It then determines the target address and target port of the target database resource in the supplier's network based on the target data contract. The supplier connector creates a proxy channel pointing to the target database resource on an available proxy port. Since the channel access information sent to the demand connector includes the proxy port but not the database's target address and target port, the risk of exposing the database's true network location and the demand party bypassing the proxy channel to directly access the database is reduced. Simultaneously, by establishing an association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and access credentials, and verifying access credentials when accepting resource access connections, the forwarding scope of the proxy channel corresponds to the authorized resources defined by the data contract, improving the controllability of cross-organizational database access.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this application and, together with the specification, serve to explain the technical solutions of this application. It should be understood that the following drawings only show some embodiments of this application and should not be considered as limiting the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart of a point-to-point secure networking method provided in an embodiment of this application is shown; Figure 2 This illustration shows a schematic diagram of a point-to-point secure networking device provided in an embodiment of this application; Figure 3 A schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0021] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0022] Research has revealed that cross-network access methods primarily focus on resolving network connectivity issues. The established access paths typically have relatively fixed network access ranges, making it difficult to restrict accessible resources based on specific data access authorizations. Furthermore, some access methods require providing the network address or port information of the data resources, increasing the risk of data resources being probed or accessed directly by bypassing the established access path.

[0023] Based on the above research, this application provides a point-to-point secure networking method and apparatus. It determines a valid target data contract based on the demand node identifier, the target database resource identifier, and access credentials. Then, based on the target data contract, it determines the target address and target port of the target database resource within the supplier's network. The supplier connector then creates a proxy channel pointing to the target database resource on an available proxy port. Since the channel access information sent to the demand connector includes the proxy port but not the database's target address and port, the risk of exposing the database's true network location and the demand party bypassing the proxy channel to directly access the database is reduced. Simultaneously, by establishing an association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and access credentials, and verifying access credentials when accepting resource access connections, the forwarding scope of the proxy channel corresponds to the authorized resources defined by the data contract, improving the controllability of cross-organizational database access.

[0024] To facilitate understanding of this embodiment, a detailed description of the point-to-point secure networking method disclosed in this application embodiment will be provided first. The execution subject of the point-to-point secure networking method provided in this application embodiment is generally a computer device with a certain computing capability. This computer device includes, for example, a terminal device, a server, or other processing devices, such as a supplier connector. In some possible implementations, this point-to-point secure networking method can be implemented by a processor calling computer-readable instructions stored in memory.

[0025] See Figure 1 The diagram shows a flowchart of a point-to-point secure networking method provided in an embodiment of this application. The executing entity of this method can be a supplier connector. The method includes steps S101 to S105, wherein: S101. Receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes the target database resource identifier and access credentials.

[0026] The application scenario for this method can be a data circulation system that includes supplier connectors and demand connectors. The supplier connectors are deployed on the data provider side, and the demand connectors are deployed on the data demand side. The target database resources are located in the supplier network that the supplier connectors can access.

[0027] The supplier connector receives channel establishment requests from the demand connector, determines the target database resource requested by the demand connector based on data access authorization, creates a proxy channel on the supplier connector pointing to the target database resource, and forwards data between the demand connector and the target database resource through the proxy channel. The demand connector sends channel establishment requests, receives channel access information returned by the supplier connector, and initiates resource access connections to the supplier connector based on the channel access information.

[0028] Supplier connectors and demand connectors can be implemented as software programs or backend services running on physical servers, virtual machines, containers, or edge computing devices, or as dedicated devices with processors, memory, and network interfaces. Demand applications access target database resources through demand connectors; demand connectors do not directly connect to the internal addresses of the target database resources within the supplier's network.

[0029] Supplier connectors and demand connectors can be collectively referred to as connector nodes, and each connector node has a corresponding node identifier. The node identifier is used to distinguish different connector nodes and can be an identifier assigned during connector registration, a certificate serial number of the node certificate, a public key identifier, or other information that can uniquely identify the connector node. The connector node's network address is used for network communication, while the node identifier is used for identity differentiation and authorization relationship matching.

[0030] The supplier connector stores or can access data contract information, resource mapping information, access credential information, proxy port configuration information, and channel management information. A data contract is electronic data representing the data access authorization relationship between a data provider and a data requester, and may include a contract number, supplier node identifier, requester node identifier, authorized resource identifier, contract validity period, and access restriction information. A valid data contract is one that is currently in effect and has not exceeded its validity period.

[0031] Resource mapping information is used to record the correspondence between database resource identifiers and database access locations in the provider's network. It can include the database resource identifier, target address, target port, and resource status. The target address can be the Internet Protocol address, internal domain name, or virtual network address of the target database resource in the provider's network, and the target port is the port that provides database services to the target database resource.

[0032] Access credentials are used to indicate that the demand connector is qualified to access resources. They can be tokens, random strings, or data structures consisting of multiple credential fields. Access credential information may include the demand connector name, random value, credential type, credential status, and credential validity period. Access credentials may not directly contain information about the target database resource; the supplier connector records the association between access credentials and the demand node identifier, data contract, target database resource, and proxy channel through channel management information.

[0033] Proxy port configuration information includes the start and end ports of the proxy port range, and may also include the maximum number of connections for the proxy channel, idle timeout duration, and connection probe wait time. Channel management information is used to record created proxy channels and may include channel number, demand node identifier, contract number, target database resource identifier, access credentials, proxy port, target address, target port, creation time, channel status, and number of active connections.

[0034] When the demand connector needs to access the database resources provided by the supplier, it sends a channel establishment request to the supplier connector. The channel establishment request includes at least the target database resource identifier and access credentials, and may also include the access session identifier, request time, and demand connector version information.

[0035] Channel establishment requests can be sent through the existing management communication interface between connectors. This management communication interface is used to transmit channel establishment requests and their response information, at which point the proxy channel for accessing the target database resource has not yet been created.

[0036] The supplier connector can determine the demand node identifier corresponding to the demand connector based on the source of the channel establishment request and the registration or authentication information of the demand connector.

[0037] In one implementation, the supplier connector obtains the node certificate of the demand connector, verifies the validity period, issuer, and certificate fingerprint of the node certificate, and, upon successful verification, determines the certificate serial number or public key identifier of the node certificate as the demand node identifier. Even if the node certificate contains a network address attribute, the supplier connector does not use that network address as the node identifier for matching the data contract.

[0038] The supplier connector can also verify whether the demand connector holds the private key corresponding to the node certificate through a random number challenge. The supplier connector generates a random number, processes it into a challenge message, and sends it to the demand connector. The supplier connector receives the challenge response from the demand connector after processing the challenge message using its private key, and verifies the challenge response using the demand connector's public key. Upon successful verification, the supplier connector confirms that the demand connector's identity has been successfully authenticated.

[0039] In some embodiments, after the supplier connector and the demand connector complete authentication, a session key can be determined based on a key exchange protocol, and the session key can be used to protect subsequently transmitted data. Node certificate verification, random number challenge, and session key negotiation can be implemented using existing secure communication protocols.

[0040] S102. If the access credential is found to be valid, a target data contract is determined from the valid data contracts based on the demand node identifier and the target database resource identifier, and the target address and target port of the target database resource in the supplier network are determined based on the target database resource defined by the target data contract.

[0041] The supplier connector queries the access credential information based on the access credential in the channel establishment request, verifies whether the access credential exists, whether the credential status is valid, whether the current time is within the validity period of the credential, and whether the demand connector corresponding to the access credential matches the demand node identifier.

[0042] If the access credential does not exist, is invalid, has expired, or does not match the demand node identifier, the supplier connector rejects the channel establishment request and returns a credential verification failure message to the demand connector.

[0043] If the access credentials are valid, the supplier connector queries the valid data contract based on the demand node identifier and the target database resource identifier. The supplier connector compares the demand node identifier, the target database resource identifier, and the current time with the demand node identifier, authorized resource identifier, and contract validity period in each data contract, and identifies the data contract whose information matches as the target data contract.

[0044] If no matching valid data contract exists, or the target database resource identifier does not belong to the authorized resource specified in the data contract, the supplier connector rejects the channel establishment request and records the demand node identifier, target database resource identifier, and request time corresponding to this request.

[0045] In some embodiments, the system further includes a management platform. The management platform is used to perform connector registration, node information management, data contract management, and access credential management. Supplier connectors can retrieve valid data contracts from the management platform according to a synchronization cycle and update locally stored data contracts based on the retrieval results. For example, a supplier connector can retrieve valid data contracts every five minutes to ensure eventual consistency between locally stored data contracts and those in the management platform.

[0046] After the target data contract is determined, the supplier connector obtains the target database resource identifier from the target data contract, and queries the resource mapping information based on the target database resource identifier to determine the target address and target port of the target database resource in the supplier network.

[0047] The target address and target port are only stored in the supplier connector's resource mapping information and channel management information. When the supplier connector subsequently sends channel access information to the demand connector, it does not include the target address and target port in the channel access information.

[0048] In this embodiment, the target database resource can correspond to a database instance, an access point for a database cluster, or other database services that can be accessed through a target address and a target port.

[0049] In implementations employing transparent transport control protocol proxies, the proxy channel uses the database service or database instance corresponding to the target database resource as the forwarding target. It does not parse the database protocol, nor does it directly identify the tables, columns, or rows involved in the database operations. Database table-level, column-level, or row-level access permissions can be controlled through the database account, database view, or independent database protocol proxy configured by the provider for the demand side.

[0050] S103. Determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials.

[0051] Before establishing a proxy channel, the supplier connector can send a Transmission Control Protocol (TCP) connection probe request to the target address and target port. If a connection is successfully established within the connection probe wait time, it is determined that the target database resource is currently accessible. If the connection probe fails, the creation of the proxy channel is rejected, and a message indicating that the target database resource is inaccessible is returned to the demand connector.

[0052] The supplier connector starts from the first port in the proxy port range and sequentially checks the occupancy status of each candidate proxy port. The occupancy status of a candidate proxy port can be determined by querying channel management information and attempting to bind to the candidate proxy port.

[0053] If the current candidate proxy port is already occupied by another proxy channel or another application, the supplier connector continues to detect the next candidate proxy port. The supplier connector determines the first unoccupied candidate proxy port as the available proxy port. If there are no unoccupied candidate proxy ports within the proxy port range, the creation of the proxy channel is refused, and a proxy port resource shortage message is returned.

[0054] Once an available proxy port is identified, the supplier connector sets the target address and target port as the forwarding target of the proxy channel, starts the Transmission Control Protocol (TCP) listening service on the available proxy port, and sets the proxy channel to a waiting connection state.

[0055] A proxy channel is a data forwarding relationship created by the supplier connector based on the target data contract. It includes available proxy ports, target addresses, target ports, and associated information corresponding to this authorized access. The proxy channel is used to forward data from the demand connector to the target database resource and to forward data returned by the target database resource to the demand connector.

[0056] The supplier connector assigns a channel number to the proxy channel and records the channel number, demand node identifier, target data contract number, target database resource identifier, access credentials, available proxy port, target address, target port, creation time, channel status, and number of active connections in the channel management information, thereby establishing the association between the proxy channel and the demand node identifier, target data contract, target database resource, and access credentials.

[0057] S104. Send the channel access information of the proxy channel to the demand connector. The channel access information includes the available proxy port but does not include the target address and the target port.

[0058] After the proxy channel is successfully created, the supplier connector generates channel access information and sends it to the demand connector. The channel access information may include the supplier connector's declared address, available proxy ports, channel number, and channel validity period, but does not include the target address and target port of the target database resource.

[0059] The supplier connector can determine the declared address in sequence according to the priority of the configured external address, the network address of the specified network interface card, the network address of the network virtual interface card, and the public address.

[0060] Specifically, the supplier connector first determines whether an external address is configured. If an external address is configured, it is determined as the advertised address. If no external address is configured, it determines whether a specified network interface card (NIC) is configured, and if so, obtains the network address of that NIC.

[0061] If a specified network interface card (NIC) has been configured, but a valid network address for that NIC cannot be obtained, the supplier connector will stop the address determination process and output an address resolution failure message, and will no longer use a low-priority address.

[0062] If no specific network interface card (NIC) is configured, the supplier connector obtains the network address of the virtual NIC. The virtual NIC can be an overlay network interface used to connect different connector nodes, such as a virtual NIC with the interface name wt0.

[0063] If a network address is not yet obtained, the supplier connector can send a request to an external network address probing service to obtain the public IP address used by the supplier connector to access the external network, and then designate this public IP address as the advertised address. When using a public IP address as the advertised address, the supplier network can configure corresponding inbound routes, port mappings, or other network access paths.

[0064] Supplier connectors can report their current declared address during registration or when sending heartbeat messages. During operation, the supplier connector re-determines the declared address and updates the reported address with subsequent registration or heartbeat messages when the declared address changes. Demand connectors can obtain the updated declared address when establishing new proxy channels or re-establishing resource access connections.

[0065] S105. Accept the resource access connection initiated by the demand connector on the available proxy port, verify the access credentials corresponding to the resource access connection according to the association relationship, and after the verification is successful, forward the data between the resource access connection and the target database resource through the proxy channel.

[0066] A resource access connection is a specific network connection initiated by the demand-side connector to an available proxy port of the supplier connector based on channel access information. A proxy channel represents the forwarding configuration and authorization relationship between the available proxy port and the target database resource, and a resource access connection represents the specific connection established based on this forwarding configuration. A proxy channel can accept one or more resource access connections.

[0067] After obtaining the channel access information, the demand connector initiates a resource access connection based on the declared address and available proxy port in the channel access information. The connection establishment information of the resource access connection can carry the channel number and access credentials.

[0068] Channel numbers and access credentials can be transmitted via connection verification information at the connector layer. The supplier connector first reads the connection verification information, verifies the channel number and access credentials, and then forwards subsequent received data as database protocol data after verification. Therefore, the supplier connector can complete access credential verification without parsing the database protocol.

[0069] The supplier connector queries the channel management information based on the channel number and verifies the access credentials based on the found associations. The verification includes whether the access credentials are consistent with the access credentials recorded in the channel management information, whether the access credentials are valid, whether the access credentials are within the validity period, whether the demand node identifier is consistent with the demand node identifier associated with the proxy channel, and whether the target data contract and target database resources associated with the proxy channel match the current resource access connection.

[0070] When verification fails, the supplier connector rejects the resource access connection. When verification succeeds, the supplier connector accepts the resource access connection and establishes a target database connection with the target address and target port.

[0071] The supplier connector forwards data bytes received through the resource access connection to the target database connection, and forwards data bytes received through the target database connection to the resource access connection, thus forming a bidirectional byte stream forwarding.

[0072] During bidirectional byte stream forwarding, the supplier connector does not parse the database protocol data. The demand connector accesses the target database resource through the supplier connector's advertised address and available proxy port, without obtaining the target address and target port of the target database resource in the supplier's network.

[0073] For each resource access connection accepted, the supplier connector increments the number of active connections on the proxy channel by one; for each resource access connection closed, the supplier connector decrements the number of active connections on the proxy channel by one. When the number of active connections reaches the maximum number of connections on the proxy channel, the supplier connector stops accepting new resource access connections through the available proxy ports.

[0074] In some embodiments, the channel establishment request also includes an access session identifier. The supplier connector establishes a mapping relationship between the access session identifier, access credentials, channel number, and proxy channel. An access session may correspond to one or more access credentials, an access credential may correspond to one or more channel numbers, and a channel number may correspond to a proxy channel.

[0075] An access session characterizes a single, continuous resource access process for the demand-side connector. Access session information may include an access session identifier, demand-side node identifier, creation time, most recent activity time, timeout threshold, and session status. When a verified resource access connection is established or data transmission occurs, the supplier connector updates the most recent activity time of the access session. When the difference between the current time and the most recent activity time reaches the timeout threshold, the access session is determined to have timed out. The maximum waiting time can be pre-configured by a channel closure policy and is calculated from the point when accepting new resource access connections ceases.

[0076] The supplier connector can query the corresponding proxy channel based on any one of the access session identifier, access credentials, and channel number, and perform credential verification, status update, activity time refresh, or channel closure based on the query results.

[0077] The supplier connector can also monitor the validity status of the target data contract, access session, and access credentials. When the target data contract expires, the access session times out, or the access credentials expire, the supplier connector sets the proxy channel to a pending closure state and stops accepting new resource access connections.

[0078] When active data transmission in the proxy channel is completed or the maximum waiting time is reached, the supplier connector closes the proxy channel and related target database connections, deletes the corresponding mapping relationships and channel management information, and restores the proxy port to an idle state. For ongoing data transmission, the supplier connector can first stop accepting new resource access connections and then wait for the current data transmission to complete, in order to reduce the impact of directly interrupting resource access connections on data transmission integrity.

[0079] In some embodiments, the supplier connector may send Transmission Control Protocol (TCP) connection probe requests to the target address and target port according to a health check cycle. If multiple connection probes fail consecutively, the supplier connector sets the proxy channel to a fault state and attempts to re-establish the connection with the target database resource. Upon successful re-establishment, the proxy channel is restored to an available state; if re-establishment fails, channel fault information is output.

[0080] In some embodiments, the management platform may maintain certificate revocation information. When determining the demand node identifier or verifying resource access connections, the supplier connector queries whether the demand connector's node certificate is in a revoked state. When a node certificate is revoked, the supplier connector rejects the corresponding demand connector's channel establishment request and resource access connection.

[0081] The management platform can also provide updated node certificates to connector nodes before the node certificates expire. Connector nodes can save the current node certificate and the updated node certificate during the certificate renewal process, and stop using the original node certificate after the node certificate switch is completed.

[0082] For example, demand node N02 requests access to database resource R01, and the channel establishment request carries access credential T01. The supplier connector determines that demand node N02 and database resource R01 correspond to a valid data contract C01, and determines the target address of database resource R01 as 10.10.1.20 and the target port as 3306 based on the resource mapping information.

[0083] The supplier connector determines port 20003 as an idle port from the proxy port range, starts the Transmission Control Protocol listening service on port 20003, sets 10.10.1.20 and 3306 as forwarding targets, and establishes the association between the proxy channel and the demand node N02, data contract C01, database resource R01 and access credential T01.

[0084] The supplier connector sends channel access information to the demand connector, including the supplier connector's declared address, port 20003, and channel number, but does not send the target address 10.10.1.20 and target port 3306. The demand connector initiates a resource access connection to port 20003 based on the channel access information, and carries the channel number and access credential T01 in the connection authentication information at the connector layer.

[0085] After verifying the channel number, access credential T01, and their associated relationships, the supplier connector establishes a target database connection between 10.10.1.20 and port 3306, and performs bidirectional byte stream forwarding between the resource access connection and the target database connection. The demand connector can then access the database resource R01 defined by data contract C01, but the channel access information it obtains does not include the actual address and port of database resource R01 within the supplier's network.

[0086] In another embodiment, the supplier connector can also establish corresponding data access channels based on the resource types defined by the data contract. For file resources, the file directory defined by the data contract can be configured as the file access root directory, and the file access path can be normalized to prevent access to files outside the file access root directory via path jumps. For application programming interface (API) resources, API access requests can be forwarded according to the API path and request method defined by the data contract. For sandbox resources, an isolated execution environment can be allocated to the demand connector, and the processing tasks submitted by the demand connector can be forwarded to the isolated execution environment for execution.

[0087] This application determines the corresponding valid data contract based on the demand node identifier and the target database resource identifier, and converts the authorized target database resource into a specific target address and target port according to the target data contract. A proxy channel is then created on the available proxy port of the supplier connector, with this target address and target port as the forwarding target. Therefore, data access authorization can directly limit the forwarding objects of the proxy channel, ensuring that the demand connector can only connect to the target database resource corresponding to the target data contract through this proxy channel, without gaining access to other database resources in the supplier network by establishing a cross-network access path.

[0088] Meanwhile, the channel access information sent by the supplier connector to the demand connector includes available proxy ports but excludes the target address and target port of the target database resource. This ensures that the internal network location of the target database resource remains within the supplier's network, reducing the risk of the demand bypassing the supplier connector to directly access the target database resource, and preventing the target database resource's internal address and port from being further propagated, probed, or attacked. The supplier connector also establishes an association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and access credentials. Upon accepting a resource access connection, it re-verifies the access credentials, ensuring that connections obtaining proxy ports still meet the corresponding identity, authorized resource, and access credential requirements. This establishes a correspondence between the proxy channel and specific data access authorization, improving the controllability and security of cross-organizational database access.

[0089] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0090] Based on the same inventive concept, this application also provides a point-to-point secure networking device corresponding to the point-to-point secure networking method. Since the principle of the device in this application is similar to the point-to-point secure networking method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0091] Reference Figure 2 The diagram shown is a schematic of a point-to-point secure networking device provided in an embodiment of this application, used for a supplier connector. The device includes: The receiving module 210 is used to receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes a target database resource identifier and access credentials. The determination module 220 is used to determine, when the access credential is determined to be valid, a target data contract from the valid data contracts based on the demand node identifier and the target database resource identifier, and to determine the target address and target port of the target database resource in the supplier network based on the target database resource defined by the target data contract. The construction module 230 is used to determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credential. Sending module 240 is used to send channel access information of the proxy channel to the demand connector, wherein the channel access information includes the available proxy port but does not include the target address and the target port; The transmission module 250 is configured to accept resource access connections initiated by the demand connector on the available proxy port, verify the access credentials corresponding to the resource access connection according to the association relationship, and forward data between the resource access connection and the target database resource through the proxy channel after successful verification.

[0092] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0093] Corresponding to Figure 1 In the point-to-point secure networking method, this application embodiment also provides an electronic device 300, such as... Figure 3 The diagram shown is a structural schematic of the electronic device 300 provided in an embodiment of this application, including: The system comprises a processor 31, a memory 32, and a bus 33. The memory 32 stores execution instructions and includes main memory 321 and external memory 322. The main memory 321, also called internal memory, temporarily stores the computational data in the processor 31, as well as data exchanged with external memory such as a hard disk. The processor 31 exchanges data with the external memory 322 through the main memory 321. When the electronic device 300 is running, the processor 31 communicates with the memory 32 through the bus 33, causing the processor 31 to execute the following instructions: Receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes the target database resource identifier and access credentials. If the access credentials are found to be valid, the target data contract is determined from the valid data contracts based on the demand node identifier and the target database resource identifier, and the target address and target port of the target database resource in the supplier network are determined based on the target database resource defined by the target data contract. Determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials; Send the channel access information of the proxy channel to the demand connector, the channel access information including the available proxy port but excluding the target address and the target port; The system accepts resource access connections initiated by the demand connector on the available proxy port, verifies the access credentials corresponding to the resource access connection according to the association, and forwards data between the resource access connection and the target database resource through the proxy channel after successful verification.

[0094] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the point-to-point secure networking method described in the above method embodiments. The storage medium can be either volatile or non-volatile computer-readable storage.

[0095] This application also provides a computer program product that carries program code. The instructions included in the program code can be used to execute the steps of the point-to-point secure networking method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0096] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0097] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0100] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0101] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

Claims

1. A point-to-point secure networking method, applied to supplier connectors, characterized in that, include: Receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes the target database resource identifier and access credentials. If the access credentials are found to be valid, the target data contract is determined from the valid data contracts based on the demand node identifier and the target database resource identifier, and the target address and target port of the target database resource in the supplier network are determined based on the target database resource defined by the target data contract. Determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials; Send the channel access information of the proxy channel to the demand connector, the channel access information including the available proxy port but excluding the target address and the target port; The system accepts resource access connections initiated by the demand connector on the available proxy port, verifies the access credentials corresponding to the resource access connection according to the association, and forwards data between the resource access connection and the target database resource through the proxy channel after successful verification.

2. The method according to claim 1, characterized in that, The channel access information also includes the declared address of the supplier connector; Before sending the channel access information, the method further includes: The declared address is determined sequentially according to the priority of the configured external address, the network address of the specified network interface card, the network address of the network virtual interface card, and the public address obtained through the external network address detection service; If the specified network interface card is configured but a valid network address for the specified network interface card cannot be obtained, stop determining the declared address and output an address resolution failure message.

3. The method according to claim 1 or 2, characterized in that, The determination of the demand node identifier corresponding to the demand connector includes: Obtain the node certificate of the demand connector and verify the validity period, issuer, and certificate fingerprint of the node certificate; After successful verification, the certificate serial number or public key identifier of the node certificate is determined as the identifier of the demand node.

4. The method according to claim 1 or 2, characterized in that, Before creating the proxy channel, the method further includes: Send a connection probe request to the target address and the target port, and when the connection probe is successful, sequentially check the occupancy status of each candidate proxy port starting from the starting port of the proxy port range; The first unoccupied candidate proxy port is identified as the available proxy port, and if there are no unoccupied candidate proxy ports within the scope of the proxy ports, the creation of the proxy channel is rejected.

5. The method according to claim 4, characterized in that, Creating the proxy channel on the available proxy port includes: Start the Transmission Control Protocol (TCP) listening service on the available proxy port; After successful verification, the process of forwarding data between the resource access connection and the target database resource via the proxy channel includes: Establish a target database connection based on the target address and the target port; Bidirectional byte stream forwarding is performed between the resource access connection and the target database connection, and the number of active connections in the proxy channel is updated. When the number of active connections reaches the maximum number of connections for the proxy channel, accepting new resource access connections will stop.

6. The method according to claim 1 or 2, characterized in that, The channel establishment request also includes an access session identifier, and the access credential has a credential status and a validity period; When creating the proxy channel, a channel number is assigned to the proxy channel, and a mapping relationship is established between the access session identifier, the access credential, the channel number, and the proxy channel; The step of verifying the access credentials corresponding to the resource access connection based on the association includes: Based on the mapping relationship, verify the credential status and validity period of the access credential, and verify whether the demand node identifier, target data contract and target database resource associated with the access credential match the resource access connection.

7. The method according to claim 6, characterized in that, The method further includes: Monitor the validity status of the target data contract, the access session corresponding to the access session identifier, and the access credential; When the target data contract expires, the access session times out, or the access credential expires, stop accepting new resource access connections through the proxy channel; When active data transmission in the proxy channel is completed or the maximum waiting time is reached, the proxy channel is closed, the mapping relationship is deleted, and the available proxy port is restored to an idle state.

8. A point-to-point secure networking device for a supplier connector, characterized in that, include: The receiving module is used to receive a channel establishment request sent by the demand connector and determine the demand node identifier corresponding to the demand connector. The channel establishment request includes a target database resource identifier and access credentials. The determination module is used to determine the target data contract from the valid data contracts based on the demand node identifier and the target database resource identifier when the access credential is determined to be valid, and to determine the target address and target port of the target database resource in the supplier network based on the target database resource defined by the target data contract. The construction module is used to determine available proxy ports from the configured proxy port range, set the target address and the target port as the forwarding target of the proxy channel, create the proxy channel on the available proxy port, and establish the association between the proxy channel and the demand node identifier, the target data contract, the target database resource, and the access credentials; The sending module is used to send the channel access information of the proxy channel to the demand connector, wherein the channel access information includes the available proxy port but does not include the target address and the target port; The transmission module is configured to accept resource access connections initiated by the demand connector on the available proxy port, verify the access credentials corresponding to the resource access connection according to the association relationship, and forward data between the resource access connection and the target database resource through the proxy channel after successful verification.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the point-to-point secure networking method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the point-to-point secure networking method as described in any one of claims 1 to 7.

Images